gcleaner | 2004-2-0x0000000000400000-0x000000000042D000-memory[.]dmp | Triage

Sharing

General

Target

2004-2-0x0000000000400000-0x000000000042D000-memory.dmp
Size

180KB
MD5

4d0a459926f352438c100b9c9f745110
SHA1

d4ee7d0d20a4f39b24a96befc34ce4ca67fd25f0
SHA256

ae749993afd684d02d94c1c0032c672c7253143a38a664e72f77e6e8239ffa0d
SHA512

3665b75727c816163ec6de4f9e833c0c7183d6200f453c2fba79f13e77663f45ac0e8d2a42340290928173822d1377a86622afe93fb2d80dc8edcd43eea55d77
SSDEEP

3072:JGyKpIBbwbTn0pDAHxzUMBBFG/zEhqw9Y2B75GwwQkZlyXUWpeuLRQ4QtJYa22Dy:QymIBbw0pDAHxzUMBBFG/zEhqw9Y2B7r

Score

10^/10

gcleaner

Malware Config

Signatures

Gcleaner family
gcleaner

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2004-2-0x0000000000400000-0x000000000042D000-memory.dmp

Files

2004-2-0x0000000000400000-0x000000000042D000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ